Description:
------------
This issue was originally raised as documentation bug 43079. Raising as Scripting Engine problem as suggested by vrana at php dot net.

The pass-by-value/pass-by-ref behaviour of call_user_func_array() is not intuitive (see the user contributed notes on the documentation page: http://php.net/call_user_func_array ).

It appears that the way in which an argument is passed depends not on the target function signature, but rather on whether its entry in $param_arr is referenced or not.

Specifically, it is possible to force an argument to be passed by
reference to a function which expects a pass-by-value argument, even
with call time pass by reference DISABLED in php.ini.

Reproduced on php5.3 and php6 snaps on Windows.

Reproduce code:
---------------
<?php
 function byRef(&$a, &$b) {
 	$a = 'changed.a';
 	$b = 'changed.b';
 }
 
 function byVal($a, $b) {
 	$a = 'changed.a';
 	$b = 'changed.b';
 }

 //Currently, this forces a pass-by-ref function to take args by val:
 $args = array('original.a', 'original.b');
 call_user_func_array('byRef', $args);
 var_dump($args);

 //Currently, this forces a pass-by-val function to take 1 arg by ref.
 //This works even with call-time pass-by-ref DISABLED in php.ini.
 $args = array('original.a', 'original.b');
 $ref = &$args[0];
 call_user_func_array('byVal', $args);
 var_dump($args); 
?>

Expected result:
----------------
array(2) {
  [0]=>
  string(9) "changed.a"
  [1]=>
  string(9) "changed.b"
}
array(2) {
  [0]=>
  &string(10) "original.a"
  [1]=>
  string(10) "original.b"
}

Actual result:
--------------
array(2) {
  [0]=>
  string(10) "original.a"
  [1]=>
  string(10) "original.b"
}
array(2) {
  [0]=>
  &string(9) "changed.a"
  [1]=>
  string(10) "original.b"
}